Generation Four - Here is where cybercrime turned professional. The malware began to hide itself, and Your Money or Your Life Files those behind it became better organized. They were mostly in Eastern European countries, and utilized more mature coders which resulted in much higher quality malware. This is when the rst rootkit avors A Short History Of Ransomware showed up. They were going for larger targets where more money could be stolen. This was also the time where traditional maas got wise to the potential and muscled into the game. Rackets like extortion of online bookmakers started to show their ugly face in Generation Four. Generation Five - The main event that created the fth and current generation was the formation of an “Fueled largely by the emergence of the anonymous online currency Bitcoin, these shakedowns are active underground economy, where stolen goods and illegal services are bought and sold in a ‘ blurring the lines between online and oine fraud, and giving novice computer users a crash course in professional’ manner, if there is such a thing as honor among thieves. Note that because of this, cybercrime modern-day cybercrime," said Krebs. Symantec reported in their August 2014 Intelligence report that has recently been developing at a much faster rate. All the tools of the trade are now for sale. This has crypto-style ransomware has seen a 700 percent-plus increase. These le-encrypting versions of ransom- opened the ‘industry’ to relatively inexperienced criminals who can learn the trade and get to work quickly. ware began the year comprising 1.2 percent of all ransomware detections, but made up 31 percent at the Some examples of this specialization are: end of August. • Cybercrime has its own social networks with escrow services One of the key methods cybercriminals are using is ransomware, most famously the Cryptolocker malware, • Malware can be licensed and receive tech support and its numerous variants, which encrypts the les on a user’s computer and demands the user pay a • You can rent botnets by the hour, for your own crime spree ransom, usually in Bitcoins, in order to receive the key to decrypt the les. But Cryptolocker is just one • Pay-for-play malware infection services have appeared that quickly create botnets approach that criminals are taking to demand ransom, and the techniques are evolving on a daily basis. To • A lively market for zero-day exploits (unknown software vulnerabilities) has been established guard against ransomware, it is not enough to know the malware that is making the rounds that day. It is vital to have a broader understanding of the topic, so one can take eective countermeasures against this evolving threat. Hacking Generations The problem with this is that it provides unfortunate economies of scale. The advent of Generation Five Let’s begin by taking a look at how cyberattacks have changed over the years. What we are facing increases malware quality, speeds up the criminal ‘supply chain’ and eectively spreads risk among these nowadays is a far cry from when people like Kevin Mitnick were breaking into phone company networks to thieves, meaning it becomes much harder to apprehend the culprits, not to mention jurisdiction problems. see what they could get away with. It is now a multi-billion global activity being run by organized Due to these factors, it is clear that we are in this for the long haul. We need to step up our game, just like cybercrime hiring experienced, professional coders and running e-commerce sites and cloud computing the miscreants have done over the last 10 years. services for criminal activities. For the purposes of this article, however, we will ignore nation-state sponsored targeted actions such as the Stuxnet attack on Iran’s uranium enrichment facilities or the The History Of Ransomware cyberespionage specialists of People’s Liberation Army Unit 61398 operating out of a 12-story building near Shanghai. Now that we’ve sketched out the various hacking generations let’s zero in on ransomware and how it has evolved over time. Generation One -Those were the teenagers in dark, damp cellars writing viruses to gain notoriety, and to show the world they were able to do it – relatively harmless, no more than a pain in the neck to a large 1989: Ransomware can be simply dened as a type of malware that restricts access to a computer system extent. We call them sneaker-net viruses as it usually took a person to walk over from one PC to another until a ransom is paid. First to hit the market was the AIDS Trojan, also known as the PC Cyborg, released with a oppy disk to transfer the virus. way back in 1989. It was written by Harvard-trained evolutionary biologist Joseph L. Popp who sent 20,000 infected diskettes labeled “AIDS Information – Introductory Diskettes” to attendees of the World Health Generation Two -These early day ‘sneaker-net’ viruses were followed by a much more malicious type of Organization’s international AIDS conference. He included a leaet with the diskettes warning that the super-fast spreading worms (we are talking 10 minutes around the globe) like Sasser and NetSky that software would “adversely aect other program applications,” and that “you will owe compensation and WHITEPAPER started to cause multi-million dollar losses. These were still more or less created to get notoriety, with possible damages to PC Cyborg Corporation; and your microcomputer will stop functioning normally.”The students showing o their “elite skills”. AIDS Trojan would count the number of times the computer was booted and once the count reached 90 Your Money or Your Life Files would hide the directories and encrypt the names of the les on the C: drive. To regain access, the user Generation Three - Here the motive shifted from recognition to remuneration. These guys were in it for would have to send $189 to PC Cyborg Corp. at a post oce box in Panama. easy money. This is where botnets came in: thousands of infected PCs owned and controlled by the cybercriminal that used the botnet to send spam, attack websites, identity theft and other nefarious The AIDS Trojan was Generation One malware and relatively easy to overcome. The Trojan used simple activities. The malware used was more advanced than the code of the ‘pioneers’ but was still easy to nd symmetric cryptography and tools were soon available to decrypt the lenames. But the AIDS Trojan set the and easy to disinfect. scene for what was to come – though it took a little while to move into high gear. 2006:When the professionals entered the picture, they combined ransomware with RSA encryption. In day. According to McAfee, part of this was that anonymous payment services made it much easier to Stealer. According to Avast: “This addition aects more than 110 applications and turns your computer to a 2006, the Archiveus Trojan encrypted everything in the MyDocuments directory and required victims to collect money than the credit card payment systems that were used with the earlier wave of fake AV botnet client. Reveton also steals passwords from 5 crypto currency wallets. The banking module targets 17 purchase items from an online pharmacy to receive the 30-digit password. In June 2006, the GPcode, an software scams. German banks and depends on geolocation. … The stealer includes 17 main modules like OS credentials, encryption Trojan which initially spread via an email attachment purporting to be a job application, used a FTP clients, browsers, email clients, instant messaging clients, online poker clients, etc. and over 140 660-bit RSA public key. Two years later, a variant (GPcode.AK) used a 1024-bit RSA key. But more importantly, the cybercrime ecosystem had come of age. Key to this was Citadel, a toolkit for submodules.” distributing malware and managing botnets that rst surfaced in January 2012. As the McAfee In the meantime, other types of ransomware circulated that did not involve encryption, but simply locked report stated: Reveton is a good example of the criminal ecosystem that now exists; malware writers license other out users. WinLock displayed pornographic images until the users sent a $10 premium-rate SMS to receive malware writer's apps and integrate them for more prot. Pony is very advanced and can pluck and decrypt the unlocking code. Another ransomware worm imitated the Windows Product Activation notice and gave “An underground ecosystem is already in place to help with services such as pay-per-install on computers encrypted passwords for FTP, VPN and email clients, web browsers and instant messaging programs. the person an international number to call to input a six-digit code. The call would be rerouted through a that are infected by other malware, such as Citadel, and easy-to-use crime packs are available in the country with high international phone rates, and the person would be kept on hold while the fees underground market. Criminals can buy kits like Lyposit—whose malware pretends to come from a local September 2013: CryptoLocker burst onto the scene racked up. law enforcement agency (based on the computer’s regional settings) and instructs victims to use payment Lockscreens and scareware are bad enough, but cryptographic malware is far worse. At least with a services in a specic country—for just a share of the prot instead of for a xed amount.” lockscreen, someone eventually develops a tool to remove it so one can regain access to their data. With An alternative approach seen in recent years is scareware. Instead of encrypting les or locking people out, encryption, however, the code must be cracked before the les can be decrypted.